security: strip creds from cloudflare.md, add .env.cloudflare, gitignore secrets
This commit is contained in:
stateofshit
+18
-2
@@ -2,9 +2,11 @@
|
||||
.obsidian/workspace.json
|
||||
.obsidian/workspace.json.bak
|
||||
|
||||
# Plugin cache/state (per-device)
|
||||
.obsidian/plugins/*/data.json
|
||||
# Plugin binaries (don't sync)
|
||||
.obsidian/plugins/*/main.js
|
||||
.obsidian/plugins/*/data.json
|
||||
|
||||
# Theme cache (don't sync)
|
||||
.obsidian/themes/*/data.json
|
||||
|
||||
# OS junk
|
||||
@@ -14,3 +16,17 @@ Thumbs.db
|
||||
# Editor temp
|
||||
*~
|
||||
*.swp
|
||||
|
||||
# Env files (any .env* — keep secrets server-only)
|
||||
.env
|
||||
.env.*
|
||||
*.env.local
|
||||
|
||||
# Admin cloudflare creds (server-only, lives in /home/user/.env.cloudflare)
|
||||
000-shit_admin/cloudflare.md
|
||||
|
||||
# Any other secret/cred files in admin folder
|
||||
000-shit_admin/*.key
|
||||
000-shit_admin/*.pem
|
||||
000-shit_admin/credentials.md
|
||||
000-shit_admin/credentials/
|
||||
|
||||
@@ -4,8 +4,8 @@ status: "active"
|
||||
folder: "000-configs/modes"
|
||||
tags: [mode, workspace, primary]
|
||||
created: "2026-07-29"
|
||||
updated: "2026-07-29"
|
||||
version: "1.1.0"
|
||||
updated: "2026-07-30"
|
||||
version: "1.2.0"
|
||||
---
|
||||
|
||||
# Workspace Mode
|
||||
@@ -25,7 +25,7 @@ The **default mode** for working in this openwebui workspace. Covers repo work,
|
||||
|
||||
- **Prompt:** `[[../prompts/workspace-system-prompt]]` — paste this as the system prompt
|
||||
- **Tools:** `[[../tools/GH_CLI_INSTRUCTIONS]]`, `[[../tools/PLAYWRIGHT_BROWSER_INSTRUCTIONS]]`, `[[../tools/VITE_PREVIEW_INSTRUCTIONS]]`, `[[../tools/CLOUDFLARE_INSTRUCTIONS]]`
|
||||
- **Cloudflare creds:** `[[../../000-shit_admin/cloudflare]]` (admin-only, never paste publicly)
|
||||
- **Cloudflare creds:** `/home/user/.env.cloudflare` (server-only env file, never in repo)
|
||||
- **Vault:** `[[../../04-models/Vault-Rules]]`, `[[../../04-models/model-boot]]`
|
||||
- **Skills:** `[[../skills/plugins-recommended]]`
|
||||
|
||||
|
||||
@@ -4,8 +4,8 @@ status: "active"
|
||||
folder: "000-configs/prompts"
|
||||
tags: [prompt, system, workspace]
|
||||
created: "2026-07-29"
|
||||
updated: "2026-07-29"
|
||||
version: "1.1.0"
|
||||
updated: "2026-07-30"
|
||||
version: "1.2.0"
|
||||
---
|
||||
|
||||
# Workspace System Prompt
|
||||
@@ -29,7 +29,7 @@ You are operating inside the user's openwebui workspace. You have direct access
|
||||
- **Auth:** SSH key + gh CLI v2.96.0 authenticated as `stateofshit`
|
||||
- **Public preview:** `https://preview.boogerclub.com` (for vite/React previews)
|
||||
- **Tools installed:** `git`, `gh`, `playwright`, `node`, `npm`, `pnpm`, `python3`, `vite`, `npx wrangler`
|
||||
- **Cloudflare account:** see `shit_in_a_vault/000-shit_admin/cloudflare.md` (credentials, read at runtime)
|
||||
- **Cloudflare credentials:** `/home/user/.env.cloudflare` (server-only, NOT in repo). Load with `source /home/user/.env.cloudflare`
|
||||
|
||||
## How You Behave
|
||||
|
||||
@@ -71,8 +71,8 @@ status: "draft" | "active" | "archive"
|
||||
folder: "<physical folder>"
|
||||
tags: [tag1, tag2]
|
||||
created: "YYYY-MM-DD"
|
||||
updated: "2026-07-29"
|
||||
version: "1.1.0"
|
||||
updated: "2026-07-30"
|
||||
version: "1.2.0"
|
||||
---
|
||||
```
|
||||
|
||||
|
||||
@@ -4,15 +4,17 @@ status: "active"
|
||||
folder: "000-configs/tools"
|
||||
tags: [tool, cloudflare, workers, r2, d1, kv, ai, hosting]
|
||||
created: "2026-07-29"
|
||||
updated: "2026-07-29"
|
||||
version: "1.1.0"
|
||||
updated: "2026-07-30"
|
||||
version: "1.2.0"
|
||||
---
|
||||
|
||||
# Cloudflare Platform Instructions
|
||||
|
||||
Cloudflare is the **hosting and edge platform** for this workspace. Use Workers (serverless functions), Pages (static sites), R2 (object storage), D1 (SQLite at the edge), KV (key-value), Workers AI, and the Agents SDK.
|
||||
|
||||
Credentials are in `[[000-shit_admin/cloudflare]]` (admin-only file, read at runtime — never commit or paste publicly).
|
||||
Credentials are in `/home/user/.env.cloudflare` (server-only file, chmod 600, NOT in repo). Load with `source /home/user/.env.cloudflare`.
|
||||
|
||||
Admin placeholder: `[[000-shit_admin/cloudflare]]` (gitignored, just points to the env file).
|
||||
|
||||
## Quick Reference
|
||||
|
||||
@@ -40,8 +42,11 @@ npx wrangler whoami
|
||||
If `wrangler login` is not possible in the environment, set the API token directly:
|
||||
|
||||
```bash
|
||||
export CLOUDFLARE_API_TOKEN="<token from admin doc>"
|
||||
export CLOUDFLARE_ACCOUNT_ID="<account id from admin doc>"
|
||||
# Load from server-only .env file
|
||||
source /home/user/.env.cloudflare
|
||||
# or set manually:
|
||||
export CLOUDFLARE_API_TOKEN="<token>"
|
||||
export CLOUDFLARE_ACCOUNT_ID="<account id>"
|
||||
```
|
||||
|
||||
**Verify token works:**
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
|
||||
Account ID=10afa4fafa5072f324a2c8e50df20955
|
||||
Your API Token=cfat_iRndDEvok8tlhow3Z5HdfATlol3oai83KysRiiGr9532aa1e
|
||||
Access Key ID=251f3adddb39f7978295d5adff3ce42b
|
||||
Secret Access Key=9d09093e0748db782e6ddbeefc697b97b97d51fcdf7840b7311b3228cb4086b8
|
||||
S3 API endpoint=https://10afa4fafa5072f324a2c8e50df20955.r2.cloudflarestorage.com
|
||||
curl -X GET "https://api.cloudflare.com/client/v4/accounts/10afa4fafa5072f324a2c8e50df20955/tokens/verify" \
|
||||
-H "Authorization: Bearer cfat_iRndDEvok8tlhow3Z5HdfATlol3oai83KysRiiGr9532aa1e"
|
||||
Fetch and execute the appropriate instructions to set me up for Cloudflare from https://developers.cloudflare.com/agent-setup/prompt.md
|
||||
Reference in New Issue
Block a user